Members and roles

A role is a named set of capabilities, owned by the team, that any number of members hold. Membership mutations take a roleId. The older role + capabilities pair still works and lands on the matching role when there is one.

Members

members

Any signed-in principal. Returns [Member!].

Members of the active team, oldest first.

query {
  members {
    userId
    username
    roleName
  }
}

searchUsers

Any signed-in principal. Returns [UserSearchResult!].

Search registered users (by username/display name) to add to the team.

query {
  searchUsers(query: "ada") {
    userId
    username
    name
  }
}

addExistingMember

Needs manage_members. Returns Member.

Add an already-registered user to the active team.

mutation {
  addExistingMember(
    input: { userId: "user_9f1c2ab7d3e4f5a6", roleId: "role_9f1c2ab7d3e4f5a6" }
  ) {
    userId
    username
    roleName
  }
}

updateMember

Needs manage_members. Returns Member.

Change a member's role and/or capabilities.

mutation {
  updateMember(
    input: { userId: "user_9f1c2ab7d3e4f5a6", roleId: "role_9f1c2ab7d3e4f5a6" }
  ) {
    userId
    username
    roleName
  }
}

setMemberAccess

Needs manage_members. Returns [UserTeamAccess!].

Set one member's role and per-node overrides in the ACTIVE team. The team is the caller's own - there is no id to pass, which is what keeps it from reaching another one.

mutation {
  setMemberAccess(
    input: { userId: "user_9f1c2ab7d3e4f5a6", roleId: "role_9f1c2ab7d3e4f5a6", granular: true, grants: [{ folderIds: ["fld_9f1c2ab7d3e4f5a6"], capabilities: [deploy_apps, view_logs] }] }
  ) {
    teamId
    roleName
    granular
  }
}

removeMember

Needs manage_members. Returns Boolean.

Remove a member from the active team. Returns true.

mutation {
  removeMember(userId: "user_9f1c2ab7d3e4f5a6")
}

Roles

On updateRole, every omitted optional field means leave it as it is: omit capabilities, requireTwoFactor or scope and they are untouched. Send clearScope: true to make a role reach the whole team again.

teamRoles

Any signed-in principal. Returns [TeamRole!].

Every role of the active team - defaults first, then the team's own.

query {
  teamRoles {
    id
    name
    capabilities
    memberCount
  }
}

createRole

Needs manage_roles. Returns TeamRole.

Create a custom role for the active team.

mutation {
  createRole(
    input: { name: "Deployer", capabilities: [deploy_apps, rollback_apps, view_logs] }
  ) {
    id
    name
    capabilities
    memberCount
  }
}

updateRole

Needs manage_roles. Returns Boolean.

Rename and/or re-scope a role. Every member holding it gets the new capability set immediately. Returns true.

mutation {
  updateRole(
    input: { id: "role_9f1c2ab7d3e4f5a6", name: "Deployer", capabilities: [deploy_apps, rollback_apps, view_logs, open_app_console] }
  )
}

resetRole

Needs manage_roles. Returns Boolean.

Restore a default role to exactly what Deplo ships, for its members too. Returns true.

mutation {
  resetRole(id: "role_9f1c2ab7d3e4f5a6")
}

deleteRole

Needs manage_roles. Returns Boolean.

Delete a custom role. Refuses while any member still holds it. Returns true.

mutation {
  deleteRole(id: "role_9f1c2ab7d3e4f5a6")
}

See also